General

  • Target

    JaffaCakes118_039be8dcab701779e699c21fa790e8e0

  • Size

    790KB

  • Sample

    241231-ehz8wswnfx

  • MD5

    039be8dcab701779e699c21fa790e8e0

  • SHA1

    fc2bb44430052941f998a4a469b719f851a600d1

  • SHA256

    4640e247dbd962ee4f1a72779a2690c6fe947ae010af955039802e90be240bd0

  • SHA512

    b4afe7fa5437a46280b88cff35e8bb12dbe9221dc807a268fed01c1524303f1649166657eabfbd882f21486b12e9014dfd6ae626b52c2a480920a3553d13970f

  • SSDEEP

    12288:FVsXbghN8QYXJSWU4xhUQewPvdqp+q5VAgBwP3tNNVtl5w:FObwWtJZU6hUOFqpPAgBgtNNVfe

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

194.5.97.212:1199

194.5.98.70:1199

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      JaffaCakes118_039be8dcab701779e699c21fa790e8e0

    • Size

      790KB

    • MD5

      039be8dcab701779e699c21fa790e8e0

    • SHA1

      fc2bb44430052941f998a4a469b719f851a600d1

    • SHA256

      4640e247dbd962ee4f1a72779a2690c6fe947ae010af955039802e90be240bd0

    • SHA512

      b4afe7fa5437a46280b88cff35e8bb12dbe9221dc807a268fed01c1524303f1649166657eabfbd882f21486b12e9014dfd6ae626b52c2a480920a3553d13970f

    • SSDEEP

      12288:FVsXbghN8QYXJSWU4xhUQewPvdqp+q5VAgBwP3tNNVtl5w:FObwWtJZU6hUOFqpPAgBgtNNVfe

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks